System and method for cellular call monitoring using downlink channel correlation

ABSTRACT

Methods and systems for monitoring communication of mobile communication terminals, such as cellular phones. An off-air monitoring system reconstructs both directions of a call conducted between two mobile terminals by receiving only downlink channels. The off-air monitoring system receives multiple downlink transmissions transmitted by base stations in a wireless communication network. The system uses the received downlink transmissions to reconstruct the bidirectional call content of calls conducted between wireless terminals. In order to reconstruct the bidirectional content of a given call, the system identifies and correlates the two downlink transmissions of that call from among the multiple received downlink transmissions.

FIELD OF THE DISCLOSURE

The present disclosure relates generally to communication monitoring,and particularly to methods and systems for monitoring using downlinkchannel correlation.

BACKGROUND OF THE DISCLOSURE

Various techniques for monitoring communication in wirelesscommunication networks are known in the art. Some monitoring systems usepassive, off-air techniques that receive wireless signals transmitted bywireless terminals and/or base stations.

SUMMARY OF THE DISCLOSURE

An embodiment that is described herein provides a method includingreceiving multiple downlink transmissions that are transmitted in atleast one wireless communication network. First and second downlinktransmissions, which carry respective first and second oppositedirections of a given call, are identified among the multiple downlinktransmissions. A content of the given call is reconstructed from theidentified first and second downlink transmissions.

In some embodiments, identifying the first and second downlinktransmissions includes extracting first signaling information from thefirst downlink transmission, extracting second signaling informationfrom the second downlink transmission, and finding a correlation betweenthe first and second signaling information. In an embodiment, extractingthe first and second signaling information includes extracting a firstidentifier from the first downlink transmission and a second identifierfrom the second downlink transmission, and finding the correlationincludes correlating the first and second identifiers with a samecommunication terminal that participates in the given call.

In another embodiment, identifying the first and second downlinktransmissions includes identifying a call-progress signaling patternthat is correlative in time in the first and second downlinktransmissions. In yet another embodiment, identifying the first andsecond downlink transmissions includes extracting first voice contentfrom the first downlink transmission and second voice content from thesecond downlink transmission, and finding a correlation between thefirst and second voice contents. Finding the correlation may includedetecting a time correlation between voice activity periods in the firstvoice content and silence periods in the second voice content.

In some embodiments, receiving the downlink transmissions includesreceiving the first downlink transmission from a first base station, andreceiving the second downlink transmission from a second base stationthat is different from the first base station. In an embodiment,receiving the downlink transmissions includes receiving the firstdownlink transmission from a first wireless communication network, andreceiving the second downlink transmission from a second wirelesscommunication network that is different from the first wirelesscommunication network.

In a disclosed embodiment, receiving the downlink transmissions includesreceiving the first downlink transmission using a first receiver, andreceiving the second downlink transmission using a second receiver thatis separate from the first receiver. In an embodiment, reconstructingthe content includes reconstructing the given call in real-time whilethe given call is in progress. In an alternative embodiment,reconstructing the content includes reconstructing the given calloff-line after the given call ends.

In some embodiments, identifying the first and second downlinktransmissions includes applying multiple different correlation criteriato the multiple downlink transmissions. Applying the multiple differentcorrelation criteria may include applying a first correlation criterionto the multiple downlink transmissions so as to identify a set ofcandidate pairs of the downlink transmissions, and applying a secondcorrelation criterion to the set of the candidate pairs so as toidentify the first and second downlink transmissions.

There is additionally provided, in accordance with an embodiment that isdescribed herein, apparatus including at least one receiver and aprocessor. The receiver is configured to receive multiple downlinktransmissions that are transmitted in at least one wirelesscommunication network. The processor is configured to identify among themultiple downlink transmissions first and second downlink transmissionsthat carry respective first and second opposite directions of a givencall, and to reconstruct a content of the given call from the identifiedfirst and second downlink transmissions.

There is also provided, in accordance with an embodiment that isdescribed herein, apparatus including a storage device and a processor.The storage device is configured to store multiple downlinktransmissions that are received from at least one wireless communicationnetwork. The processor is configured to identify among the multipledownlink transmissions first and second downlink transmissions thatcarry respective first and second opposite directions of a given call,and to reconstruct a content of the given call from the identified firstand second downlink transmissions.

The present disclosure will be more fully understood from the followingdetailed description of the embodiments thereof, taken together with thedrawings in which:

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram that schematically illustrates a system formonitoring calls in a wireless communication network, in accordance withan embodiment that is described herein; and

FIG. 2 is a flow chart that schematically illustrates a method formonitoring calls in a wireless communication network, in accordance withan embodiment that is described herein.

DETAILED DESCRIPTION OF EMBODIMENTS Overview

When a wireless communication terminal conducts a call via a basestation of a wireless network, one direction of the call is transmittedon an uplink channel from the terminal to the base station, and theopposite direction of the call is transmitted on a downlink channel fromthe base station to the terminal. In many communication monitoringapplications, it is desirable to monitor both directions of the call andto reconstruct the full bidirectional call content.

In practice, however, monitoring uplink channels is often much moredifficult than monitoring downlink channels. For example, base stationstypically have a higher transmission power and superior line-of-sightconditions than terminals. Put in another way, the downlink channel cantypically be received at much greater distances than the correspondinguplink channel. Therefore, an off-air monitoring system is often able toreceive the downlink channel but not the uplink channel of a giventerminal. In such a case, the monitoring system will be unable toreconstruct the bidirectional call content.

Embodiments that are described herein provide improved methods andsystems for monitoring communication of mobile communication terminals,such as cellular phones. In the disclosed embodiments, an off-airmonitoring system reconstructs both directions of a call conductedbetween two mobile terminals by receiving only downlink channels.

The disclosed techniques are based on the fact that, in a call betweentwo wireless terminals, the downlink channel transmitted to one terminalcarries the same content as the uplink channel transmitted from theother terminal. Therefore, the bidirectional content of such a call (asopposed to a call between a wireless terminal and a wire-line terminaloutside the wireless network) can be reconstructed from the two downlinkchannels transmitted to the two terminals.

In some embodiments, the off-air monitoring system receives multipledownlink transmissions transmitted by base stations in a wirelesscommunication network. The system uses the received downlinktransmissions to reconstruct the bidirectional call content of callsconducted between wireless terminals. In order to reconstruct thebidirectional content of a given call, the system identifies andcorrelates the two downlink transmissions of that call from among themultiple received downlink transmissions.

Several example techniques for correlating a pair of downlinktransmissions belonging to the same call are described herein. In someembodiments, the system correlates signaling information (e.g., terminalidentifiers) that is extracted from the downlink transmissions. In otherembodiments, the system finds a call-progress pattern (e.g., call set-upand/or call termination signaling pattern) that is correlative in timein a pair of downlink transmissions. As yet another example, the systemmay establish the correlation based on voice content that is extractedfrom the downlink transmissions (e.g., by finding a correlation betweenvoice activity periods in one downlink transmission and silence periodsin another downlink transmission).

In summary, the disclosed techniques receive only downlinktransmissions, but nevertheless reconstruct the two opposite directionsof monitored calls. Since the disclosed techniques are based only ondownlink transmissions, the monitoring system may be located at a largedistance from the monitored network and it may operate successfullyunder harsh channel and interference conditions. The various correlationcriteria between downlink transmissions enable real-time, near-real-timeor off-line reconstruction of the bidirectional call content.

Although the embodiments described herein refer mainly to cellularnetworks, the downlink transmissions may be received from other types ofnetworks, such as satellite networks. In some embodiments, the twocorrelative downlink transmissions of a call originate from twodifferent wireless networks, such as two different cellular networks ora terrestrial cellular network and a satellite communication network.

System Description

FIG. 1 is a block diagram that schematically illustrates a system 20 formonitoring calls in a wireless communication network 24, in accordancewith an embodiment that is described herein. System 20 can be used, forexample, for gathering intelligence or tracking suspects in variousGovernment and Lawful Interception (LI) applications.

Wireless network 24 may comprise any suitable wireless communicationnetwork that operates in accordance with any suitable wireless standardor protocol, for example a cellular network such as a Global System forMobile Communications (GSM), Code Division Multiple Access (CDMA),Universal Mobile Telecommunications System (UMTS) or iDEN network.Network 24 comprises multiple base stations (BTSs) 32 and other nodessuch as switches (not shown).

Although the embodiments described herein refer mainly to cellularnetworks, the disclosed techniques can also be used with other types ofwireless networks, such as satellite communication networks. Examples ofsatellite networks include Thuraya, Iridium, Inmarsat, among others. Thedisclosed techniques can also be used to correlate downlink channelsfrom different networks, such as two different cellular networks, twodifferent satellite networks or a cellular network and a satellitenetwork. Certain aspects of joint monitoring of a cellular network and asatellite network are addressed in Israel Patent Application 212968,entitled “System and method for joint passive interception of satelliteand cellular communication,” filed May 18, 2011, whose disclosure isincorporated herein by reference.

Wireless communication terminals 28, such as cellular phones,communicate via BTSs 28 with one another, and/or with wireless orwire-line terminals in other networks. The example of FIG. 1 shows threeBTSs and two terminals for the sake of clarity. Real-life networkstypically comprise a large number of BTSs and terminals.

Monitoring system 20 monitors and reconstructs the content of callsconducted between terminals 28, by receiving and correlating downlinkchannels from BTSs 32. (In the present context, the terms “downlinkchannels” and “downlink transmissions” are used interchangeably.)

System 20 comprises an antenna 36 for receiving downlink signals fromthe BTSs. A front-end receiver 40 down-converts the downlink signals tobaseband, digitizes the baseband signals and decodes the downlinktransmissions from the signals. In some embodiments, system 20 comprisesa call database 44 for storing content of received downlinktransmissions, signaling of received downlink transmissions, metadatarelated to received downlink transmissions and/or any other suitableinformation. Database 44 may be implemented using any suitable storagedevice.

A correlation processor 48 processes the received downlink transmissionsin order to reconstruct the bidirectional content of calls, usingtechniques that are described in detail below. The reconstructed callcontent, possibly together with metadata or other information related tothe calls, are provided to a monitoring center 52 and presented to anoperator 56.

The configuration of system 20 shown in FIG. 1 is an exampleconfiguration, which is chosen purely for the sake of conceptualclarity. In alternative embodiments, any other suitable systemconfiguration can also be used. Some elements of system 20 may beimplemented in hardware, e.g., in one or more Application-SpecificIntegrated Circuits (ASICs) or Field-Programmable Gate Arrays (FPGAs).Additionally or alternatively, some system elements can be implementedusing software, or using a combination of hardware and softwareelements.

Some of the functions of system 20, such as the functions of correlationprocessor 48, may be carried out using one or more general-purposeprocessors, which are programmed in software to carry out the functionsdescribed herein. The software may be downloaded to the processors inelectronic form, over a network, for example, or it may, alternativelyor additionally, be provided and/or stored on non-transitory tangiblemedia, such as magnetic, optical, or electronic memory.

Bidirectional call Reconstruction Based on Downlink TransmissionCorrelation

In some embodiments, correlation processor 48 reconstructs the content(typically voice content) of calls that are conducted between terminals28 of network 24, exclusively based on downlink transmissions andwithout a need to receive uplink transmissions.

Consider the example shown in FIG. 1. In this example, two terminals 28denoted “terminal A” and “terminal B” conduct a voice call with oneanother. During this call, terminal A communicates with network 24 via aBTS denoted “BTS A”, and terminal B communicates with the network via aBTS denoted “BTS B”. (As explained above, the embodiments describedherein refer mainly to cellular networks, but the disclosed techniquescan also be used in satellite networks. In the case of a satellitedownlink channel, a satellite plays the role of the BTS.)

The call is carried over a total of four channels: One direction of thecall (from terminal A to terminal B) is carried first over an uplinkchannel of terminal A denoted “Uplink A” and then over a downlinkchannel of terminal B denoted “downlink B”. The opposite direction ofthe call (from terminal B to terminal A) is carried first over an uplinkchannel of terminal B denoted “Uplink B” and then over a downlinkchannel of terminal A denoted “downlink A”.

In such a terminal-to-terminal call, the voice content of uplink A istransmitted over downlink B, and the voice content of uplink B istransmitted over downlink A. Therefore, system 20 is able to reconstructthe two opposite directions of the call from downlink A and downlink B,without a need to receive any of the uplink channels.

In a typical embodiment, receiver 40 of system 20 receives a largenumber of downlink transmissions. Some of the received downlinktransmissions belong to terminal-to-terminal calls, and others (e.g.,downlink C received from BTS C) may not. The received downlinktransmissions are typically stored in call database 44.

In order to reconstruct the bidirectional content of a given call fromamong the large number of received downlink transmissions, processor 48needs to identify the pair of downlink transmissions that carry the twodirections of that call. Typically, processor 48 has no prioridentification of pairs of downlink transmissions, and therefore itestablishes the correlation using characteristics of the downlinktransmissions themselves.

FIG. 2 is a flow chart that schematically illustrates a method formonitoring calls in network 24, in accordance with an embodiment that isdescribed herein. The method begins with receiver 40 receiving multipledownlink transmissions from BTSs 32 of network 24, at a reception step60. The receiver typically records the received downlink transmissionsin database 44.

Correlation processor 64 correlates a pair of received downlinktransmissions that carry the opposite directions of the sameterminal-to-terminal call, at a correlation step 64. Based on theestablished correlation, processor 64 reconstructs the bidirectionalcontent of the call from the pair of downlink transmissions, at areconstruction step 68. The call content is typically provided as outputto monitoring center 52.

The method description above refers to correlation and processing of asingle call, for the sake of clarity. Typically, however, processor 48carries out this process, possibly simultaneously, for a large number ofcalls. In some embodiments the processor is provided with a predefinedlist of target terminals, and reconstructs the calls conducted by thesetarget terminals. In other embodiments, processor 48 reconstructs callsindiscriminately, i.e., regardless of any prior designation of terminalsas targets.

Example Correlation Criteria

In various embodiments, correlation processor 48 may use various methodsand criteria for identifying a pair of downlink transmissions that carrythe opposite directions of the same call.

In one embodiment, processor 48 extracts signaling information from thedownlink transmissions, and attempts to correlate pairs of downlinktransmissions whose signaling information indicates that they belong tothe same call. As noted above, the signaling of different downlinktransmissions may originate from different networks that operate inaccordance with different protocols. For example, one downlinktransmission may comprise a GSM call while another downlink transmissionmay comprise a CDMA call. As another example, one downlink transmissionmay carry Thuraya signaling while another downlink transmission maycarry GSM signaling. Alternatively, the downlink transmissions mayoriginate from the same network.

The signaling information may comprise, for example, identifiers ofterminals 28 such as International Mobile Subscriber Identity (IMSI) orTemporary Mobile Subscriber Identity (TMSI). In this embodimentprocessor 48 may extract one identifier from one downlink transmission,another identifier from another downlink transmission, and correlate thetwo identifiers to determine that the two downlink transmissions belongto the same call.

In many practical cases, the signaling in a given downlink transmissioncarries the phone number (e.g., caller ID or called number) of theopposite side of the call (the receiving side typically signals thecalling number, the originating side typically signals the callednumber).

The over-the-air signaling usually carries only the TMSI of the sidethat is intercepted, but in various scenarios processor 48 may havesucceeded in previously correlating the TMSI to the IMSI/MSISDN of thatterminal. This sort of correlation may be performed, for example, usingequipment that is sometimes referred to as IMSI catcher. Techniques ofthis sort are addressed, for example, in Israel Patent Application212577, entitled “System and method for combined passive and activeinterception of mobile communication,” filed Apr. 28, 2011, whosedisclosure is incorporated herein by reference.

In some embodiments, processor 48 focuses on correlating downlinktransmissions based on Call Control (CC) messages in the downlinktransmission signaling. Such messages are typically time-synchronizedbetween the two sides of the call, and therefore are good candidates forestablishing the correlation. CC messages that can be used by processor48 for correlation may comprise, for example, a SETUP message(containing the dialed number when sent from the mobile terminal to theBSC, and containing the calling number when sent in the oppositedirection), an ALERT message (sent when the receiving side startsringing), an ANSWER message (sent when the receiving side answers), aDISCONNECT message used for signaling call disconnection, and/or anyother suitable message.

In another embodiment, processor 48 identifies a pair of downlinktransmissions that together exhibit a call-progress signaling patternthat is correlative in time and characteristic of a single call.Typically, wireless communication protocols define the exactcall-progress signaling to be followed, for example, in call set-up andcall termination procedures. These procedures typically define the orderof signaling messages exchanged between the two endpoints of the call,as well as timing constraints for signaling messages and responses.

In an example embodiment, processor 48 identifies a pair of downlinktransmissions having the same call start time, the same call durationand/or the same call end time. In another embodiment, processor 48identifies a pair of downlink transmissions that are consistent in termsof the session type. For example, processor 48 may correlate pairs ofdownlink transmissions in which one downlink transmission indicates anincoming session type and the other indicates an outgoing session type.In other words, processor 48 may rule out pairs of downlinktransmissions in which both transmissions indicate an outgoing sessiontype, and pairs of downlink transmissions in which both transmissionsindicate an incoming session type.

In some embodiments, processor 48 examines pairs of downlinktransmissions against the call-progress specifications of the applicablewireless protocol. If the flow of signaling messages in a pair ofdownlink transmissions meets the specification, in terms of the orderand timing of signaling messages, processor 48 may conclude that thetransmissions are likely to belong to the same call. If the flow ofsignaling in a pair of downlink transmissions violates thespecification, processor 48 typically concludes that they belong todifferent calls.

In other embodiments, processor 48 identifies a pair of downlinktransmissions that carry the opposite directions of the same call byextracting and correlating the voice content of the transmissions. Forexample, in a typical voice call, when one party speaks the other partyis silent. Therefore, in a typical voice call there is high correlationbetween periods of voice activity in one call direction and periods ofsilence in the opposite call direction.

In some embodiments, processor 48 assesses the correlation between theoccurrence of voice activity periods in one downlink transmission andsilence periods in another downlink transmission. If the correlation ishigh, processor 48 may conclude that the two transmissions are likely tocarry the opposite directions of the same call, and vice versa. Forexample, processor 48 may measure the percentage of time in which voiceactivity is detected simultaneously in both transmissions, and compareit to the percentage of time in which voice activity is detected only inone of the transmissions. As another example, processor 48 may identifypairs of downlink transmissions having correlative voice activitypatterns.

In alternative embodiments, processor 48 may use any other suitablemethod or criterion for identifying pairs of downlink transmissions thatcarry the opposite directions of the same call.

The correlation criteria described above may be applied in real-time(e.g., while the call is still in progress), in semi-real-time (e.g.,shortly after the call), or off-line. For example, correlation based oncall set-up signaling can be used for real-time correlation, whereascorrelation based on voice activity or call termination are moresuitable for semi-real-time correlation. Off-line correlation can becarried out using any of the disclosed techniques.

In some embodiments, processor 48 uses a combination of two or morecorrelation criteria, in order to increase the correlation confidencelevel and eliminate false correlations. In some embodiments, processor48 establishes a certain initial correlation based on one criterion(e.g., establishes a list of candidate pairs of transmission based oncall set-up signaling correlation), and then refines the list usinganother criterion (e.g., voice activity or call termination signaling).This progressive technique enables system 20 to provide real-time outputhaving a certain initial confidence level, and later increase theconfidence level and refine the results.

In the embodiments described above, the two terminals conducting thecall communicate via different BTSs of the same wireless network. Thetechniques described herein, however, are in no way limited to thisscenario. For example, system 20 may receive the two downlinktransmissions of the same call from a single BTS, e.g., when the twoterminals are in close proximity.

As another example, in a given call, one terminal may communicate in onewireless network and the other terminal may communicate in anotherwireless network. In this embodiment, system 20 may receive downlinktransmissions from BTSs in both wireless networks, and establish thecorrelations a explained above. The two wireless networks may operate inaccordance with the same wireless protocol or different wirelessprotocols.

As yet another example, system 20 may comprise multiple receivers and/orantennas that are not necessarily collocated. In an example embodiment,a distributed configuration of system 20 comprises multiple receivers 40(with respective antennas 36) located in different geographicallocations. The downlink transmissions received by the multiple receiversare provided to processor 48 for analysis as explained above. This sortof distributed configuration enables system 20 to receive downlinktransmissions from a large number of BTSs over a wide geographical area,and/or from different wireless networks.

Although the embodiments described herein mainly address cellularnetworks, the principles of the present disclosure can also be used forcorrelating downlink transmissions is other types of networks or acrossdifferent network types. In one example embodiment, system 20 receivesthe downlink transmissions from a satellite of a satellite communicationnetwork (e.g., Thuraya). In this embodiment, system 20 may intercept thebidirectional content between satellite terminals by correlating twodownlink transmissions from the satellite network (or from two differentsatellite networks).

In another example embodiment, system 20 receives downlink transmissionsfrom a cellular network (e.g., a GSM network), as well as downlinktransmissions from a satellite of a satellite communication network(e.g., Thuraya). In this embodiment, system 20 may intercept thebidirectional content between a cellular terminal and a satelliteterminal by correlating a respective downlink transmission from eachnetwork type.

It will thus be appreciated that the embodiments described above arecited by way of example, and that the present disclosure is not limitedto what has been particularly shown and described hereinabove. Rather,the scope of the present disclosure includes both combinations andsub-combinations of the various features described hereinabove, as wellas variations and modifications thereof which would occur to personsskilled in the art upon reading the foregoing description and which arenot disclosed in the prior art. Documents incorporated by reference inthe present patent application are to be considered an integral part ofthe application except that to the extent any terms are defined in theseincorporated documents in a manner that conflicts with the definitionsmade explicitly or implicitly in the present specification, only thedefinitions in the present specification should be considered.

The invention claimed is:
 1. A method, comprising: intercepting, by amonitoring system, only multiple downlink transmissions that aretransmitted from a base station or satellite of a wireless communicationnetwork towards wireless communication terminals of the wirelesscommunication network; identifying, by the monitoring system, among themultiple downlink transmissions, first and second downlink transmissionsthat are associated with respective first and second wirelesscommunication terminals, wherein the first downlink transmission carriesa first portion of a given call conducted between the first and secondwireless communication terminals which as intercepted on its way fromthe base station or satellite to the second wireless communicationterminal, and wherein the second downlink transmission carries a secondportion of the given call which was intercepted on its way from the basestation or satellite to the first wireless communication terminal; andreconstructing, by the monitoring system, a content of the given callfrom the identified first and second downlink transmissions.
 2. Themethod according to claim 1, wherein identifying the first and seconddownlink transmissions comprises extracting first signaling informationfrom the first downlink transmission, extracting second signalinginformation from the second downlink transmission, and finding acorrelation between the first and second signaling information.
 3. Themethod according to claim 2, wherein extracting the first and secondsignaling information comprises extracting a first identifier from thefirst downlink transmission and a second identifier from the seconddownlink transmission, and wherein finding the correlation comprisescorrelating the first and second identifiers with a same communicationterminal that participates in the given call.
 4. The method according toclaim 1, wherein identifying the first and second downlink transmissionscomprises identifying a call-progress signaling pattern that iscorrelative in time in the first and second downlink transmissions. 5.The method according to claim 1, wherein identifying the first andsecond downlink transmissions comprises extracting first voice contentfrom the first downlink transmission and second voice content from thesecond downlink transmission, and finding a correlation between thefirst and second voice contents.
 6. The method according to claim 5,wherein finding the correlation comprises detecting a time correlationbetween voice activity periods in the first voice content and silenceperiods in the second voice content.
 7. The method according to claim 1,wherein intercepting the downlink transmissions comprises interceptingthe first downlink transmission from a first base station, andintercepting the second downlink transmission from a second base stationthat is different from the first base station.
 8. The method accordingto claim 1, wherein intercepting the downlink transmissions comprisesintercepting the first downlink transmission from a first wirelesscommunication network, and intercepting the second downlink transmissionfrom a second wireless communication network that is different from thefirst wireless communication network.
 9. The method according to claim1, wherein intercepting the downlink transmissions comprisesintercepting the first downlink transmission using a first receiver, andintercepting the second downlink transmission using a second receiverthat is separate from the first receiver.
 10. The method according toclaim 1, wherein reconstructing the content comprises reconstructing thegiven call in real-time while the given call is in progress.
 11. Themethod according to claim 1, wherein reconstructing the contentcomprises reconstructing the given call off-line after the given callends.
 12. The method according to claim 1, wherein identifying the firstand second downlink transmissions comprises applying multiple differentcorrelation criteria to the multiple downlink transmissions.
 13. Themethod according to claim 12, wherein applying the multiple differentcorrelation criteria comprises applying a first correlation criterion tothe multiple downlink transmissions so as to identify a set of candidatepairs of the downlink transmissions, and applying a second correlationcriterion to the set of the candidate pairs so as to identify the firstand second downlink transmissions.
 14. Apparatus, comprising: at leastone receiver, which is configured to intercept only multiple downlinktransmissions that are transmitted from a base station or satellite of awireless communication network towards wireless communication terminalsof the wireless communication network; and a processor, which isconfigured to identify among the multiple downlink transmissions firstand second downlink transmissions that are associated with respectivefirst and second wireless communication terminals, wherein the firstdownlink transmission carries a first portion of a given call conductedbetween the first and second wireless communication terminals which hasbeen intercepted on its way from the base station or satellite to thesecond wireless communication terminal, and wherein the second downlinktransmission carries a second portion of the given call which has beenintercepted on its way from the base station or satellite to the firstwireless communication terminal, and configured to reconstruct a contentof the given call from the identified first and second downlinktransmissions.
 15. The apparatus according to claim 14, wherein theprocessor is configured to extract first signaling information from thefirst downlink transmission, to extract second signaling informationfrom the second downlink transmission, and to find a correlation betweenthe first and second signaling information.
 16. The apparatus accordingto claim 15, wherein the processor is configured to extract a firstidentifier from the first downlink transmission and a second identifierfrom the second downlink transmission, and to correlate the first andsecond identifiers with a same communication terminal that participatesin the given call.
 17. The apparatus according to claim 14, wherein theprocessor is configured to identify the first and second downlinktransmissions by identifying a call-progress signaling pattern that iscorrelative in time in the first and second downlink transmissions. 18.The apparatus according to claim 14, wherein the processor is configuredto extract first voice content from the first downlink transmission andsecond voice content from the second downlink transmission, and to finda correlation between the first and second voice contents.
 19. Theapparatus according to claim 18, wherein the processor is configured tofind the correlation by detecting a time correlation between voiceactivity periods in the first voice content and silence periods in thesecond voice content.
 20. The apparatus according to claim 14, whereinthe at least one receiver is configured to intercept the first downlinktransmission from a first base station, and to intercept the seconddownlink transmission from a second base station that is different fromthe first base station.